It seems there are several separable issues:

  what is the default buffer size if one doesn't change it
  what is the default behavior of tcpdump
  what is the default behavior of dhclient
  what is the max buffer size that can be set
  what is the behavior if one tries to set more than works

Failure to allocate memory should always be handled reasonably, so
letting someone make a call to set the buffer size to 1M when they
don't have 2M of memory and fail is fine.  There is only a problem if
tcpdump/dhclient by default try to do this.  For dhclient, even 32K
seems big, because there is a bpf filter to get just the packets of
interest.  So perhaps the default should stay  lower, with the default
tcpdump behavior being to increase it.

Arguably the tcpdump command line should let you set the buffer size;
one tcpdump of a high stream argues for using large buffers, and
running 20 tcpdumps each with a narrow filter argues for smaller ones.

This argues for adding a comment, perhaps

  /* XXX Set at boot time based on available memory. */

-- 
        Greg Troxel <gdt@ir.bbn.com>